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The attached, homework by Dr. Wilhelm GERLICH of the 
German Army Sigint Service (NAAST. 1) was written in November, 1 945 
at the request of TICOM and received from H.Q., A.S. A., Europe 
under reference ASA-1 O/EFC/l ab, dated 17th January, 1 946. It 
describes his v/ork on Russian systems in the cryptanalytic section 
of NAAST 1. 


2, The preliminary interrogation report was issued as 
TICOM/l-1 56. 


TICOM 


5th March, 1946. 

No. 

of pages; 12. 



Co/ y JVo*„ )b 

u 

1 — 1 
ro 

IRIBUTION 



British: 

u.s. 


1. 

D.D. 3. 

8-11. 

0p-20-G (4) (via Cdr. Manson) 

2. 

H.C.G, 

12. 

G-2 ■ (via Lt, Col. Hilles) 

3. 

D.D. (M.W, ) 

13-16. 

A.S.A.J4) (via Cant. Colling) 

4. 

D.D. (A.S.) 

17. 

Director, A.S. A. Europe 

5. 

n t;' 

18. 

Col, Kuukel, USAnFE 

6. 

Cdr. Tandy 



7. 

Major Morgan 



TICOM 

Addit 

tonal 


19t 21<> S.A.C. (3) 28-30. Mr c Pritchard (3) 

22. Cdr. Manson 

23. Capt„ Collins 
24-27, Ticom Piles (4) 




-UJJM dPJO and ^ 



- 


PRODUCED AT TrtE NATIONAL ARCH VES 



■mp— <aprr?m <m» 


- 2 - 


TI GOl'.i/l-l 91 


Ex-p ori e n cs_ _in C ryp t ynalytic Section of NAlST 1 
B y Dr» Wilhelm G-erlioh 


2/p syste ms 

These were used by subordinate units of the Red Army up 
to the lost sto.ges of the ’•■ar > but not to the same extent 
as in the early years. They could always be decyphered if 
sufficient text was available. Usually only a few lines were 
sufficient to find the key, particularly in the case of letter 
text. The P T 0 J9 ( HEFEI' OB OP HAS TAMhIJA = word 

table 1939) ceil be taken as 0 . fundamental system. Letters 
and phrases were inserted in a certain order in a 10 x 10 square 
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The characteristic feature of the PT 39 was that the letters had. only 
one equivalent and were arranged in three oolumns. The remaining 
squares were filled by words such as " radiogramma (wireless 
message) 4 '' eta. To ascertain whether letters or words were to be 
sent, the two indicators qurTaiiTe tj'Kr.H (read letters)" 

and 11 qtiTe.foTe cjiOEa (read words)" were required. Thus 

letter texts oould in this table only begin with three different B 
positions of the cypher elements. The element in front of this 
had to be " qnrradTO 6 vicbh ", the element following these 

groups " -qHTaiiTe cJioDa " . Whatever th.e recypherment might be 
the same letters would’ always occur in the same row and column. 

E.g. A-K-$>-H were always in the same line. 


Exc pie: 


.... 72, 

qHTaflTe 

ByKBH 

13 45 55 33 

A H 0 B 


65 55 

IL 0 
15 05 

K y 


25 55 73 93 

Jl 6 2 H 


95 63 55 23 35 95 
T E 0 L C T 


=■ "Report position’ 3 . 


Method of solution: 1.) find the indicators 

2) find frequency of each cypher element and; 
structure of letter text. 


The frequency of each letter had been ascertained from a large 
number of clear texts, and a long text corresponded with this* 

In tne case of shorter texts the frequency peaks were often considerably 
displaced, so that one had only the word structure as s touting point 
of attack. 


The FT 39 was no _onger used in the latter years, about 
1941 the Russians introduced other word tables and these could 
always be reconstructed as far as the letters were concerned* 
Reconstruction of the arrangement of words was very difficult <?uid 
success was limited. 

Practically all the new word tables of the Red Army had more 
than one equivalent for each letter. The first Jo . appear were 4-6 new 
word tables, e.g* PT 456 etc.- however I can no longer remember 
them. 
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Such a table is given as an 
example. This use of several 
e quivolen ts comple tely 
obscured the frequency peaks, 
considerably increasing the 
difficulty of breaking. As 
however the Russian 
encyphsrers had- difficulty in 
finding the letters, they 
very often used the same 
square habitually, and thus 
we were able an a result of 
their laziness to discern 
structure and frequency. 

New cyphers which were 
solved were sent (for 
recognition) as "new 
cyphers” to the General 
of Sigint for passing on 
to the Sigint stations 
of the other array groups; 
they automatically sent us 
cyphers solvsd or partly solved 
by other' sigint stations. 

We possessed about 
500 solved 2/F cyphers, of 
which one or another was 
always appearing. But 
as already mentioned, 
almost all 2/F systems 


could be solved and presented no appreciable difficulty to the cryptanalyst. 


One or two men were sufficient at Sigint Station 1 to cope 
with current decyphermeno of 2/F messages, especially as the greater part of them 
were already being solved in the companies. Solution was made easier when 
P/L was interspersed. This also apjjlies to all systems and was constantly 
occurring. 


In the last stages 2/p systems only occurred where the units were 
engaged in fighting; thus it is to be expected, tint they axe still being 
used in the Red Army even if they are not appearing at the moment. 


The 3/P System , 

A 

This is a further development as compared with the 2/F system. 
Here 1000 cypher elements are available, whereas in the 2/p system there 
are only 100. Either up to 1000 words may be inserted., or else 2-3 
or even more figure groups may be used for each P/L element, i.e. :*mre 
than one equivalent. For instance, in a small code of 5 pages the pages 
might be numbered as follows i 


Page 

1 

2 

3 

4 

5 


I 

2/4 

6/7 

1/3 

5/0 

9/8 

) 

)Encypher- 
) merits . 

II 

7/4 

6/3 

1/9 

8/2 

0/5 


Thus, when reading 
off one cypher 
element the page 
number is taken 
as position A of 


the cypher element; as two figures are available for each page (e.g. for 
encypherment I 2/4. - 6/7 - l/3 ~ 5/0 - 9/8), each p/L element may be 
expressed by 2 cypher elements. Each page is divided into lines, which 
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again are numbered a^d frv..:r the BQ-pcsitions are read. For 

these a strip which may be cnangcd is fixed at the edge of each 
page bearing the figures from 00 to 99* Thus 100 lines may be 
numbered by it Q As however the Russian 3/P codes never have 
so many word equivalents as to require all the figures the use 
of more than one equivalent is possible in this case also© 

Such a strip will- accordingly then have a number of corsecutive 
figures for each page uf the code, each group formirg a so- 
called "block" [Bond]; thus .we also speak of "block” equivalents. 
If now each page has 05 lines, the blocks may be A figures long 
(lC0/A = 25 ) y so that by means of the blocks alone each word 
may be expressed by A different D3 positions. In addition to this 
there are the double equivalents on each page, so eight cypher 
equivalents are available for each word, A marginal strip 
of this type in blocks of A figures each would then appear 
something like this:- 


02-06 


98-01 


11 -Ilf 


07-10 


23-26 1 


If 3 -4 6 


31-34 


51-54 


i 5 - 1 3 

APMMfl/15 

39-42 


27-50 


47-50 


9-22 


35-38 



These strips may be exchanged and thus 
the encypherment changed. Similarly 
the page numbering may be altered. 

u 

Thus after the indicator "read words" the 
following cypher elements could all 
stand for the word APMHH (army) , 

if page 1 has the numbering 2/A: 

21 5-21 6-21 7-21 8-A1 5-4 1 6-A1 7-41 3 . 

If however these groups followed 
the indicator "read letters" they 
would mean "A 11 and after the 
indicator "read figures' 1 they 
mean " 1 5" . 


The codes are usually arranged in "partially alphabetic* 1 
order, i,e, alphabetical order is retained, within each letter 
group, but the letters themselves are not in alphabetical order 
e.g. K,o, 9 Ca.. 9 IIoc.cAoo..L.e, B etc. As already 

mentioned the initial letters of the v/ords are used for letter 
text,- single letters not being allotted positions. The figures 
are dotted about in the text groups. 

If we wish to investigate how messages encyphered 
in this way may be broken, we must begin with the preliminary 
work necessary. 

First of all material which is suspected to be on the same 
cypher [Verschlusselung] and which must be of considerable 
amount, is collected together. Statistics are then made of 
this material on a large 10 x 10 square. We pay attention to the 
predominance of cypher elements in certain squares, and to the 
various frequencies and by these means can weed out messages which 
probably do not belong to this recypherment [Uberschlusselung]. 

In the light of these statistics we now examine the 
messages, and compare the manner in which common cypher elements 
occur in the messages and in what positions. In this way repeats 
are ascertained. However, we must compare not only identical 
figures but also similar ones as we wish first of all to reconstruct 
the key strip blocks , Here the carelessness of the encypherer 
is of assistance, for he does not use the whole block but more 
frequently the first and last figures of it, .as they have been 
entered direct in the key. When the bands have been ascertained 
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by piecing together the various cypher elements, wore end more 
repeats cone to light end in the cruse c,f letter text we can gradually 
recognise word structure r e Q g 0 repetition of the same cypher element 
at definite intervals. This work is as it were clearing away the 
poly equivalence from the messages * It shows as follows in our 
frequency counts. If the pages of the code have more than one number 
each, we can, after having entered the A position in rows, combine 
these rows; we than speak of an "overlap”. Thus if in a 10 x liO 
square the cypher elements have been entered according to page 
encyphernent I (see page 2 .) the rows can then be combined* 


Having investigated the messages 
for repeats and word structure, 
we proceed to try to break in at these 
points . 


If passages showing structure 
occur at the beginning or end 
of a message, they may be assumed 
to be addresses or signatures, 
i c e. Proper names . These are 
often also given in P/L. messages 
from the network concerned 

Another point of attack in letter text are the place names 
which may be suspected in messages with co-ordinates. Of^ourse 
one must previously have ascertained in which area the traffic lies. 

Soon we shall also be able to distinguish figur e te xts 
This will be shown by frequent double cr triple recurrences. 

If we can then tentatively identify the figures with our own 
or enemy units we shall endeavour to establish them, as 
even to recover the figures only of a code is of great value^ 
enabling us to establish newly appearing units in a: 
definite area. Therefore all passages with suspected figure 
text are written out and examined for structure. If two and 
three place groups for enemy units in this area occur and have the 
same figures, reconstruction is possible. The er.cyphered date 
and the time of day at the beginning of the message are also 
of use. On one occasion I reconstructed the figures of a 
code by means of the date and the enumeration of calibres of 
German A. A* 

At the same time efforts are made to ascertain the 
indicators "read words”, ” road figures” and ”read letters” 'and 
also the punctuation marks (.), (,), (-) etc. By these 

means one can fix the beginning and ending of sentences which 
is naturally a great help. 

Simultaneously the reconstruction of the words is 
proceeding and therewith penetration of the code text. This 
work too must be done in dose collaboration with the evaluation 
from whom the cryptanalyst may learn the type of network, whether 
artillery code or Ic aode etc. 



but we also try to learn names 
from the evaluation section. 
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Attention is directed primarily to the message beginning 
and end , for here date , a ddress and signature are probably to be 
found. If for example a cypher element almost always occurs only at the 
beginning or end of a message it may be suspected to be a rank 
or appointment; e.g. HAH# DITA£A (= chief of staff). Also 
one may look for units such as .HHBE3HS (division), IIOJIK 
(regiment), APMH5I etc. I once solved a Ic-code from the 
beginning by assuming that a Ic message would probab]y begin 
with nPOTHBHMK (the enemy), this proving correat. 

The cypher elements following suspected figure text 
are also examined; they may again be unit designations, arms, 

"P/ffs"; the insertion of such words is relatively easy once the 
figure code has been artiallv recovered. HACOB (time) also 
frequently foJ lows figures * 

Another point of attack is the P/L passages frequently 
inserted by the Russians in 3/P messages. They often gave 
word and names not contained in the code in P/L. It was then 
easy to recover the cypher* elements immediately preceeding 
and following. All this work is naturally only possible 
by constantly comparing messages with each other. An experienced 
crypt analyst must have the frequent cypher elements in his 
head and always be ready to- accept new hypotheses and reject 
old ones. 


A special class of messages is those with g rid r e ferences . 
Having ascertained from the evaluation whether they concern 
the line of the front or rear areas, in which case they might be 
locations of HQ ? s or similar points, or whether they are 
references in front of the line which might be targets for attack, 
we can then attempt to insert identifications from the map. One 
would expect points of the compass and also geographical terms 
such as "fores 4 -", "coppice", "strip", "area" and military terms suoh 
as "sector" etc., to occur. 

Work on short messages will be described for thu Hr 3 system, 
and can be used here also, 

lords which have been found must then correspond as far 
as possible with the position of the letters ascertained in the 
10 x 10 square. If for example a cypher element has been identified as 
"C00BII(HTE ,r and its neighbours in the square are elements beginning 
with ^ , the newly identified word must then not be "COOBGIMTE" 

(report) but "^CUIOHITE" (submit) . 

3/p systems v/ere always solved when sufficient material 
on one encypherment was available. 
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A/p systems 

These were used, from corps to army and from army to army 
group. For this reason they were of especial importance and 
great value was attached to their solution. I can no longer 
remember these codes in detail, I know that I have worked 
on the R l+Z Cl 800 but no longer have any clear idea of it. I 
will therefore as before record my experience in the hope that it 
may be of some use. 

Before one can proceed to solve a code, one must first aim 
at obtaining a large amount of similar material, e.g, messages on 
the same recypherment. A large amount of material is therefore 
absolutely necessary, and the majority of unsolved A/F codes were 
abandoned because of an insufficient number of messages. A more 
frequent change of recypherment would have made decypherment impossible* 

This similar material was then subjected to frequency counts. 

In doing this similar cypher elements could be picked out and 
important repeats established, and in certain circumstances one could 
find the first evidences of word structure in this way. The 
A/F codes had almost without exception block numbering, in the 
BC positions or in the AS and BC positions. This block numbering 
or poly-equivalence could be ascertained by means of the repeats. 
Thereby the ’’blocks” were discovered and when these had been 
only partially recovered one could find further repeats and 
word structure, in the case of letter text. 

One then tried to break into this letter text, but 
naturally one could not take advantage of common words such as 
HEM^^JIHHO or OBOTpHA with their well-known structure, for 
theSe words were giventneir own cypher elements in the code. It was 
very cominon for the structure of the ends of messages to be worked 
on, as here or at the beginning of the message one expected to find 
proper names. These were frequently sent in l/l. and were then 
listed to find out at which units or HQ’s the persons mentioned wore. 

The evaluation section often supplied us with names. 

One also tried to insert place names, particularly in the 
case of transport or supply codes. We possessed for example 
several messages on a traffic established by T.A. as a supply 
traffic, in which truck numbers were given in clear. Between 
these truck numbers were cypher elements with obvious 
structure. As the area in which the code was used was also known, 
and the cypher passages v. r ere assumed to be place names, possible 
names e.g. those lying on the supply routes were sought. By 
inserting them a tentative letter text was obtained, the 
likelihood of which could then be checked by other messages. 

Another point of attack, again with numbers, were messages in 
which numbers of our own or of enemy formations v/ere mentioned. 

Even if the rest of the code had not yet been solved, the 
insertion of numbers often gave useful results, when 
previously unknown enemy units could be established thereby. 
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We should mention however that in the codes for individual units 
(e,g, 26th rifle division = 34-09) separate cypher elements were 
provided; but owing to careless encypherment the various units 
were often sent with every simple number enoyphered [in full]. 
One could then break in. And when mentioning enemy units the 
encyphcrer was naturally forced to encypher each number 
separately. In one code I once recovered the numbers by 
means of a message in which the number and calibre of guns 
in German A. A. units were given. 

In connection with letter text, the Russian often 
spelt with the first two letters of the words occurring in 
the code. For example if he wished to send HEHCCj£ 
he could take after the indicator ’’read letters’ 1 : 

HE - from HEMEWEHHO, 

HG- - from HCII'OJIHEHHE , and. so on. 

The word text was recovered simultaneously with the letter , and 
•figure text, each depending on the other. It was important 
to solve the messages as covapletely as possible. Recovery 
of words was much easier when in addition to the indicators the 
punctuation signs had been recovered, md when one knew which 
cypher elements represented figures, or one had perhaps already 
recovered the letter text. 


Here again beginning and end were scrutinised, as 
containing address or signature, A cypher element occurring 
almost always in these two positions might be a rand or 
appointment, e.g. HA 1 !* 1DTABA (chief of staff) or HAH 
OnEPOTAEJIA (chief of operational section). 

Following figure text units, arms, P/W’s etc., could be 
guessed. Here one naturally oannot give a theoretical 
’’unfailing” method of breaking. What is correct in one 
instance may be false in another. Thorough knowledge of the 
material and instinct are the most important factors. 


It is usual to obtain the first word identifications 
from the short messages of 2 or 3 cypher elements. These are 
routine orders from a superior authority: 


£0JI0)KHTE OPCmHQBKy 
CP0HH0 ROJIOMHE 0ECTAH0BK7 


- report situation, 

= report situation immediately. 


The short message from the subordinate unit might then be 
identified as; 0BCTAH0BKA EE3 K3MEHEHM0 
= situation unchanged. 

These identifications were then inserted in all messages 
where they occurred, affording the first steps towards solution; 
they could often be added to if favourable passages of P/L were inter- 
spersed,, Messages with grid references, giving the front line or 
HQ locations, are also useful. Here dose collaboration with the 
evaluation section is absolutely necessary. With luck words such 
as ” river” , ’’wood”, prepositions and points of the compass may be 
inserted. 


If one has got so far, the code may be considered partially 
broken. Given sufficient messages new identif ications will always 
become evident. 
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Transposition systems 


These were comparatively rarely used b}' the Russians, 
who were usually content with substitution systems, e,g 0 
substitution alphabets and codes. 

I do not know whether such transposition systems 
were solved at Sigint Stn. 1, however I know that transposition 
messages were being read, that "stencils'* etc,, were used; 
however I think they were solved at General of Sigint' s, The 
following remarks are not based on my personal experience 
but on the course which I attended at General of Sigint' s from 
October, 1-944 - end of December, 1944# The same importance 
was not attached there to these types of encypherment for 
Russian as there was in the course for English which rein about 
the same time, as we were told even then that the Russians rarely 
used these systems, but that they were the prevailing systems 
in the armies of the Western powers a 

The first step is to determine the key length, e.g„ 
the number of letters which are transposed among themselves. 

This was done by lining up the messages; they were written 
out in long lines under each other and the lowest message 
shifted one place at a time, the number of times "clicks" were 
obtained being counted. With sufficient material the key 
length must reveal itself. Hollerith machines were available 
for this laborious work of comparison. The shorter the key length 
the easier to find. Having ascertained it, the message was written 
out in a cage of this length. If in the following example the 
length had been found to be 1 6 by lining up a large number of 
messages, the message was written out in a cage of 16 and the lines 
then re transposed until with luck and patience a b re ale in was 
found. For this figure text, names, message beginnings and endings 
etc., were helpful as before. Thus looking at the message given in 
Appendix "A" the figures in the first group attract our 
attention. Being at the beginning they can be assumed to be a 
date. If we know that the message was sent on 13/12/44, we can 
tentatively insert the date. This leaves the elements R 9 V 9 
H, B, ( * ) over in the first line. It is fairly easy to 
reconstruct the message beginning as follows: 13 (•) 12 

( , ) 1944 T ( □ ) n and the message is thus solved, as with the help of 
the second line the key is quickly arrived at: 3, 8,10,16,6,12,13, 
15, 1,7, 9, 14, 2, 4*5, 11 . The solved message will then read: 

JIHil 13 c 12 . 191(4 r » d 07 <iacoB ~ utonaji - b - 
njieH - H6 MertKHii - cepscaHT - pa3De^HBaTejri>:ioro - 
OT^ejia . SL - ero - cefi^ac - OToejiaji - c £ ByMH 
- coji^aTaMH - k - mTa6y - avlb.kqvlvl • IIpoTm- 
hmk noTepiiJi - 6 - o$K3epoD - 37 - cojuaT , 

1 - npoTH botb hko B oe - opy^ne - 2 - Kopo - 
6o^kvl , 5 - nyjreMeTOB - h - 30 - pyr.en . 

Ha^ajiBHMK - KTTaOa nojima IIoiiob 
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Translation: "on 1 3/12/44 at 07 hours a German sergeant of the 

recce detachment was taken prisoner. I sent him to div* HQ at 
once with 2 soldiers. The enemy lost 6 officers, 37 soldiers, 

1 A/T gun, 2 tanks, 5 m.g*s and. 30 rifles. Chief of Regt. Staff 
Fopof f" . 


The transposition key was obtained from a square V x A (- 1 6 ) 


with a stencil of the form shown, which was 
successively rotated 90° clockwise, the 
figures being read from left to right 
and top to bottom. 



In conclusion I repeat 
experience of transposition 
based the above description 
will therefore give a short 
a cryptanalyst was normally 


that I have had no practical 
systems at Sig.int Sfcn. 1, but have 
on the cryptanalysis course. I 
description, to show what training 
given . 


Cryptanalysis cour se 

In August 1944 an examining board arrived at the Russian 
interpreters* company and gave the higher classes in the 
interpreters* training school a series of intelligence tests 9 
Russian word puzzles ond numerical puzzles v.-ere set, these being 
successfully solved by 12 out of the 150 - 200 persons tested* 

These were sent at the beginning of October to Juterbog to the 
so-called cryptanalysis course. Oberfunker Wein, sometime 
lecturer in philosophy at Berlin University, conducted the 
course under the supervision of 0berinsx>* Kuhn. 

We began with simple substitution in German and in general 
most systems were first treated in German and then in Russian* 
Then followed in logical sequence: 

substitution with more than one equivalent, 
substitution with alternative significations [mehrdentig] 

(indicators,') 

syllabic substitution, 

P.T. 39; 

the other substitutions in 10 x 10 tables introduced by 
the Russians during 191-1/4.2, 

3/P codes, 4/F codes, 
columnar substitution, 
periodic substitution [Springcasaren ], 
introduction to transposition systems. 

The course was boused in part on actual Russian messages but 
these, ond also the systems, were out of date, so that though the 
course afforded the groundwork, one had no opportunity until 
arriving at Sigint Stn. 1 of becoming familiar with the more 
up-to-date material. Obviously as one requires a large amount 
of message material in the case of actual codes, the big codes 
were not illustrated in this way by practical examples during 
the course, although in practice the majority of 
cryptanalysts were working on such l/F codes. 

Dr. Wilhelm Gerlich. 


[Trans: A.C.J. ]§■ 
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APPENDIX "A !l 
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The message is written out in the key length; 
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